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Abstract 

We present a propositional logic to reason about the uncertainty of events, where the 
uncertainty is modeled by a set of probability measures assigning an interval of probability 
to each event. We give a sound and complete axiomatization for the logic, and show that 
the satisfiability problem is NP-complete, no harder than satisfiability for propositional 
logic. 

1. Introduction 

Various measures exist that attempt to quantify uncertainty. For many trained in the use 
of probability theory, probability measures are an obvious choice. However, probability 
cannot easiliy capture certain situations of interest. Consider a simple example: suppose 
we have a bag of 100 marbles; we know 30 are red and we know the remaining 70 are 
either blue or yellow, although we do not know the exact proportion of blue and yellow. If 
we are modeling the situation where we pick a ball from the bag at random, we need to 
assign a probability to three different events: picking up a red ball {red-event), picking up 
a blue ball {blue-event), and picking up a yellow ball {yellow- event). We can clearly assign 
a probability of .3 to red-event, but there is no clear probability to assign to blue-event or 
yellow-event. 

One way to approach this problem is to represent the uncertainty using a set of proba- 
bility measures, with a probability measure for each possible proportion of blue and yellow 
balls. For instance, we could use the set of probabilities V = {/^q : a G [O;-''']}, where 

gives red-event probability .3, blue-event probability a, and yellow-event probability 
.7 — a. To any set of probabilities V we can assign a pair of functions, the upper and lower 
probability measure, that for an event X give the supremum (respectively, the infimum) of 
the probability of X according to the probability measures in V. These measures can be 
used to deal with uncertainty in the manner described above, where the lower and upper 
probability of an event defines a range of probability for that event. ^ (This example can 
be viewed as giving a frequentist interpretation of upper probabilities. Upper probabilities 
can also be given a subjective interpretation, for example, by considering the odds at which 
someone would be willing to accept or reject a bet (Smith, 1961; Walley, 1991).) 

1. Note that using sets of probability measures is not the only way to model this situation. An alternative 
approach, using inner measures, is studied by Fagin and Halpern (1991). 
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Given a measure of uncertainty, one can define a logic for reasoning about it. Fagin, 
Halpern and Megiddo (1990) (FHM from now on) introduce a logic for reasoning about 
probabilities, with a possible- worlds semantics that assigns a probability to each possible 
world. They provide an axiomatization for the logic, which they prove sound and complete 
with respect to the semantics. They also show that the satisfiability problem for the logic, 
somewhat surprisingly, is NP-complete, and hence no harder than the satisfiability problem 
for propositional logic. They moreover show how their logic can be extended to other notions 
of uncertainty, such as inner measures (Fagin & Halpern, 1991) and Dempster-Shafer belief 
functions (Shafer, 1976). 

In this paper, we describe a logic for reasoning about upper probability measures, along 
the lines of the FHM logic. The logic allows reasoning about linear inequalities involving 
upper probabilities measures. Like the logics considered in FHM, our logic is agnostic 
as to the interpretation of upper probabilities, whether frequentist or subjectivist. The 
main challenge is to derive a provably complete axiomatization of the logic; to do this, we 
need a characterization of upper probability measures in terms of properties that can be 
expressed in the logic. Many semantic characterizations of upper probability measures have 
been proposed in the literature. The characterization of Anger and Lembcke (1985) turns 
out to be best suited for our purposes. Even though we are reasoning about potentially 
infinite sets of probability measures, the satisfiability problem for our logic remains NP- 
complete. Intuitively, we need guess only a small number of probability measures to satisfy 
any given formula, polynomially many in the size of the formula. Moreover, these probability 
measures can be taken to be defined on a finite state space, again polynomial in the size of 
the formula. Thus, we need to basically determine polynomially many values — a value for 
each probability measure at each state — to decide the satisfiability of a formula. 

The rest of this paper is structured as follows. In Section 2, we review the required 
material from probability theory and the theory of upper probabilities. In Section 3, we 
present the logic and an axiomatization. In Section 4, we prove that the axiomatization is 
sound and complete with respect to the natural semantic models expressed in terms of upper 
probability spaces. Finally, in Section 5, we prove that the decision problem for the logic is 
NP-complctc. The proofs of the new, more technical results arc given in Appendix A. To 
make the paper self-contained, we also review Anger and Lembcke's results in Appendix B. 

2. Characterizing Upper Probability Measures 

We start with a brief review of the relevant definitions. Recall that a probability measure 
is a function // : S [0, 1] for S an algebra of subsets of J7 (that is S is closed under 
complements and unions), satisfying /x(0) = 0, /x(fi) = 1, and fi{A L) B) = fJ-{A) + /u(i?) for 
all disjoint sets A,B in S.^ A probability space is a tuple (r2,S,/v,), where Q is a set, S is 
an algebra of subsets of O (the measurable sets) , and /li is a probability measure defined on 
S. Given a set V of probability measures, let V* be the upper probability measure defined 

2. If f2 is infinite, we could also require that E be a cr-algebra (i.e., closed under countable unions) and that 
fi be countably additive. Requiring countable additivity would not affect our results, since we show that 
we can take f2 to be finite. For ease of exposition, we have not required it. 



58 



A Logic for Reasoning about Upper Probabilities 



by V*{X) = sup{n{X) : fieVjfov X £ E.^ Similarly, V*{X) = inf{//(X) : n e V} is 
the lower probability of X G S. A straightforward derivation shows that the relationship 
= 1—V*{X) holds between upper and lower probabilities, where X is the complement 
of X in n. Because of this duality, we restrict the discussion to upper probability measures 
in this paper, with the understanding that results for lower probabilities can be similarly 
derived. Finally, an upper probability space is a tuple (SI, S, V) where P is a set of probability 
measures on S. 

We would like a set of properties that completely characterizes upper probability mea- 
sures. In other words, we would like a set of properties that allow us to determine if a 

function / : E ^ M (for an algebra E of subsets of SI) is an upper probability measure, 
that is, whether there exists a set V of probability measures such that for all X G E, 

r*{x) = f{x).^ 

One approach to the characterization of upper probability measures is to adapt the 
characterization of Dempster-Shafer belief functions; these functions are known to be the 
lower envelope of the probability measures that dominate them, and thus form a subclass 
of the class of lower probability measures. By the duality noted earlier, a characterization 
of lower probability measures would yield a characterization of upper probability measures. 
The characterization of belief functions is derived from a generalization of the following 
inclusion-exclusion principle for probabilities (obtained by replacing the equality with an 
inequality) : 

n n 

i=l i=l JC{l,...,n} j&J 

\J\=i 

It seems reasonable that a characterization of lower (or upper) probability measures 
could be derived along similar lines. However, as is well known, most properties derivable 
from the inclusion-exclusion principle (which include most of the properties reported in the 
literature) are insufficient to characterize upper probability measures. Huber (1981, p. 257) 
and Walley (1991, p. 85) give examples showing the insufficiencies of such properties. 

To give a sense of the insufficiency of simple properties, consider the following "inclusion- 
exclusion" -style properties, some of which are taken from (Walley, 1991). To simplify the 
statement of these properties, let = V* and V^^ = V*. 

(1) p*(Aiu---uA„) <Er=iEi7H(-ir+'^(-'^'(a-.7^.), 

(2) p.(^i u . . . u AO > EILi E|/|=.(-i)^+'^(-')^^' {f],ei ^.), 

(3) V^{AuB)+V4AnB) < V^{A)+V*{B) < V*{AU B) +V*{An B), 

3. In the literature, the term upper probabiUty is sometimes used in a more restricted sense than here. For 
example, Dempster (1967) uses the term to denote a class of measures which were later characterized as 
Dempster-Shafer belief functions (Shafer, 1976); belief functions are in fact upper probability measures 
in our sense, but the converse is not true (Kyburg, 1987). In the measure theory literature, what we call 
upper probability measures are a special case of upper envelopes of measures, which are defined as the 
sup of sets of general measures, not just probability measures. 

4. It is possible to define a notion of upper probability over an arbitrary set of subsets of f2, not necessearily 
an algebra, by simply requiring that / coincides with V* on its domain, for some set V of probability 
measures. See Walley (1991) for details. 
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(4) V^{A) + V*{B) < V*{A UB) + V*{AnB) < V*{A) + V*{B), 

(5) V^A) + V^B) <VM^B) + V*{A U B) < V*{A) + V*{B). 

Note that without the alternation between upper probabihties and lower probabilities, 
(1) and (2) would just be the standard notions of subadditivity and superadditivity, re- 
spectively. While subadditivity and superadditivity hold for upper and lower probabilities, 
respectively, (1) and (2) are stronger properties. It is easily verified that all five properties 
hold for upper probability measures. The question is whether they completely characterize 
the class of upper probability measures. We show the inherent incompleteness of these 
properties by proving that they are all derivable from the following simple property, which 
is by itself insufficient to characterize upper probability measures: 

(6) IiAnB = 0, then V*{A) + V*{B) <V*{AUB)< V*{A) + V*{B). 

Proposition 2.1: Property (6) implies properties (l)-(5). 

Observe that our property (6) is already given by Walley (1991, p. 84), as properties (d) 
and (e). The following example shows the insufficiency of Property (6). Let V be the set 
of probability measures {/^i, /^2) /^3, over J7 = {a, 6, c, d} (with E containing all subsets 
of ri) defined on singletons by 



Mi(«) 


1 
4 


W(^) = 


1 
4 


A^i(c) = 


1 

4 


fii{d) = 


1 
4 


H2{a) 


= 


/^2(6) = 


1 
8 


M2(c) = 


3 
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H2{d) = 


1 
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M3(a) 


1 
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M3(6) = 


3 
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M3(c) = 





M3(d) = 


1 
2 


M4(a) 


3 
8 


M4(&) = 





M4(c) = 


1 

8 


//4(d) = 


1 

2' 



and extended by additivity to all of S. This defines an upper probability measure V* over 
S. Consider the function i;^ : S ^ [0, 1] defined by 

.,(X) = S + e ifX = {a,6,c} 

^eV^) I Otherwise. 

We claim that the function Ve, for small enough e > 0, satisfies property (6), but cannot be 
an upper probability measure. 

Proposition 2.2: For < e < |, the function satisfies property (6), but is not an 
upper probability measure. That is, we cannot find a set V' of probability measures such 
that v^ = {V'Y. 

This example clearly illustrates the need to go beyond the inclusion-exclusion principle 
to find properties that characterize upper probability measures. As it turns out, various 
complete characterizations have been described in the literature (Lorentz, 1952; Huber, 
1976, 1981; Wilhams, 1976; Wolf, 1977; Giles, 1982; Anger & Lembcke, 1985; Walley, 1991). 
Most of these characterizations are obtained by considering upper and lower expectations, 
rather than working directly with upper and lower probabilities. Anger and Lembcke (1985) 
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give a characterization in terms of upper and lower probabilities. Since their characterization 
is particularly well-suited to the logic presented in the next section, we review it here. 

The characterization is based on the notion of set cover. A set A is said to be covered 
n times by a multiset {{Ai,... of sets if every element of A appears in at least 

n sets from Ai,. . . , Am- for all x E A, there exists distinct ii, . . . ,in in {1, • • • , m} such 
that for all j < n, x E Ai.. It is important to note here that {{^i, . . . ,^m}} is a multi- 
set, not a set; the A^'s are not necessarily distinct. (We use the {{ }} notation to denote 
multisets.) An {n,k)-cover of {A,^) is a multiset {{^i, . . . , A„J} that covers Q, k times 
and covers A n + k times. For example, {{1, 2}, {2, 3}, {1, 3}} covers {1, 2, 3} 2 times, and 
{{{1, 2}, {2, 3}, {1, 3}, {2}, {2}}} is a (2,2) cover of ({2}, {1, 2, 3}). 

The notion of (n, A;)-cover is the key concept in Anger and Lembcke's characterization 
of upper probability measures. 

Theorem 2.3: (Anger & Lembcke, 1985) Suppose that Q is a set, S is an algebra of subsets 
of Vt, and u : S — >■ M. Then there exists a set V of probability measures with v = V* if and 
only if V satisfies the following three properties: 

UPl. v{%) = 0, 
UP2. v{Q) = 1, 

UPS. for all natural numbers m, n, k and all subsets Ai, . . . , A^ in E, if{{Ai, . . . , Am}} 
is an (n, k)-cover of {A, il), then k + nv{A) < YliLi ^(^i)- 

Proof: We reproduce a proof of this result in Appendix B. | 

Note that UPl is redundant in the presence of UP2 and UPS. Indeed, {{Q, 0}} is a 
(0, l)-cover of (ri,ri), and applying UPS yields v{^) + v{n) = 1. Since UP2 states that 
v{^) = 1, this means that v{9) = 0. A further consequence of UPS is that if AC B, then 
vIa) < v{B), since {{B}} is a (l,0)-cover of {A,n). Therefore, for ah ^ € E, v{A) G [0, 1]. 

We need to strengthen Theorem 2.3 in order to prove the main result of this paper, 
namely, the completeness of the axiomatization of the logic we introduce in the next section. 
We show that if the cardinality of the state space J7 is finite, then we need only finitely 
many instances of property UPS. Notice that we cannot derive this from Theorem 2.3 
alone: even if \Q\ is finite, UPS docs not provide any bound on m, the number of sets to 
consider in an (n, k) cover of a set A. Indeed, there does not seem to be any a priori reason 
why the value of m, n, and k can be bounded. Bounding this value of m (and hence of n 
and k, since they are no larger than m) is one of the key technical results of this paper, and 
a necessary foundation for our work. 

Theorem 2.4: There exist constants Bq,Bi,... such that if Q is a finite set, S is an 
algebra of subsets of fi, and z; : S ^ M, then there exists a set V of probability measures 
such that V = V* if and only if v satisfies the following properties: 

UPFl. v{%) = 0, 
UPF2. v{^) = I, 

UPF3. for all integers m,n,k < B^q^ and all sets Ai, . . . , Am, if {{Ai, . . . , ^m}} 
is an (n, k)-cover of {A, Q), then k + nv{A) < Yll,Li ^(^i)- 
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Property UPF3 is significantly weaker than UPS. In principle, checking that UPS 
holds for a given function requires checking that it holds for arbitrarily large collections of 
sets, even if the underlying set O is finite. On the other hand, UPFS guarantees that if is 
finite, then it is in fact sufficient to look at collections of size at most B\q\. This observation 
is key to the completeness result. 

Theorem 2.4 does not prescribe any values for the constants Bq, Bi, . . . . Indeed, the 
proof found in Appendix A relies on a Ramsey-theoretic argument that does not even 
provide a bound on the Bj's. We could certainly attempt to obtain such bounds, but 
obtaining them is completely unnecessary for our purposes. To get completeness of the 
axiomatization of the logic introduced in the next section, it is sufficient for there to exist 
finite constants Bq, Bi, . . . . 

3. The Logic 

The syntax for the logic is straightforward, and is taken from FHM. We fix a set $o = 
{pi,P2, ■ ■ ■} of primitive propositions. The set $ of propositional formulas is the closure 
of $0 under A and -■. We assume a special propositional formula true, and abbreviate 
^true as false. We use p to represent primitive propositions, and ip and tp to represent 
propositional formulas. A term is an expression of the form 6il{ipi) + • • • + 9kl{(pk), where 
01, . . . ,0k are reals and A; > 1. A basic likelihood formula is a statement of the form t > a, 
where t is a term and a is a real. A likelihood formula is a Boolean combination of basic 
likelihood formulas. Wc use / and g to represent likelihood formulas. We use obvious 
abbreviations where needed, such as l{ip) — l{jp) > a for l{ip) + (—l)l{ip) > a, l{ip) > l(ijj) 
for l{ip) — l{ijj) > 0, l{ip) < a for —l{(p) > —a, l{(p) < a for ^{l{(p) > a) and l{ip) = a for 
iKv') ^ C') ^ iKv^) — '^)- Define the length |/| of the likelihood formula / to be the number 
of symbols required to write /, where each coefficient is counted as one symbol. Let C'^^ be 
the language consisting of likelihood formulas. (The QU stands for quantitative uncertainty. 
The name for the logic is taken from (Halpern, 2001).) 

In FHM, the operator / was interpreted as either "probability" or "belief" (in the sense 
of Dempster-Shafer). Under the first interpretation, a formula such as 1(lp) + l{tp) > 2/3 
would be intereted as "the probability of ip plus the probability of ^p is at least 2/3". Here 
we interpret I as upper probaiblity. Thus, the logic allows us to make statements about 
inequalities involving upper probabilities. 

To capture this interpretation, we assign a semantics to formulas in C'^^ using an upper 
probability space, as defined in Section 2. Formally, an upper probability structure is a 
tuple M = {Q, E, V, vr) where (i7, S, V) is an upper probability space and tt associates with 
each state (or world) in 17 a truth assignment on the primitive propositions in $o- Thus, 
7t{s){p) G {true, false} for s € 17 and p G ^q. Let Ip}m = {s £ Q : 7r(,s)(j9) = true}. 
We call M measurable if for each p G ^q, [pJm is measurable. If M is measurable then 
{(flu is measurable for all propositional formulas (f. In this paper, we restrict our attention 
to measurable upper probability structures. Extend 7r(s) to a truth assignment on all 
propositional formulas in a standard way, and associate with each propositional formula 
the set I^pJm = {s € O, : 7r(s)((^) = true}. An easy structural induction shows that |(^]m 
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is a measurable set. If M = E,P,7r), let 

M H eil{^i) + • • • + Okli^Pk) > a iff 0iP*([<^i1m) + • • • + ekV^ilipkU) > a 

M\=^f iff M ^ / 

M\=fAg iff M ^ f and M \= g. 

Note that r'?^ can express lower probabilities: it follows from the duality between upper 
and lower probabilities that M \= -1{-Mp) > /3 - 1 iff P*(h99lM) > /^.^ 

Consider the following axiomatization AX"^ of upper probability, which we prove sound 
and complete in the next section. The key axioms are simply a translation into C*^^ of the 
characterization of upper probability given in Theorem 2.3. As in FHM, AX"^ is divided 
into three parts, dealing respectively with prepositional reasoning, reasoning about linear 
inequalities, and reasoning about upper probabilities. 

Propositional reasoning 

Taut. All instances of propositional tautologies in £'5^ (see below). 
MP. From / and / =^ g infer g. 
Reasoning about linear inequalities 

Ineq. All instances of valid formulas about linear inequalities (see below). 
Reasoning about upper probabilities 
LI. l{false) = 0. 
L2. l{true) = 1. 
L3. l{ip) > 0. 

L4. l{ipi) + ■ ■ ■ + l{ip^) - nl{ip) > ff 99 ^ Vjc{i,...,m},|J|=fc+nAjGj'^j and 
yjc{i,...,m},\j\=kf\jGj'Pj are propositional tautologies.^ 

L5. l{ip) = l{ip) if 99 <^4> ^ is a propositional tautology. 

The only difference between AX^^ and the axiomatization for reasoning about probability 
given in FHM is that the axiom /((/? A ^) + l{ip A = l{ip) in FHM, which expresses 
the additivity of probability, is replaced by L4. Although it may not be immediately 
obvious, L4 is the logical analogue of UPS. To see this, first note that {{^1,... 
covers A m times if and only if A C |Jj(;|^ ^j. | j|=n HjeJ ^J' Thus, the formula if 
Vjc{i m} \ J\=k+n /\jeJ ^ays that ip (more precisely, the set of worlds where (p is true) 
is covered k+n times by {{ipi, ■ ■ ■ , ^n}}, while Vjc{i m} \ J\=k f\j&J 'Pj ^ays that the whole 
space is covered k times by {{^i, ■ ■ ■ , '■Pn}}] roughly speaking, the multiset {{pi, ■ ■ ■ , (fn}} 
is an (n, /c)-cover of {ip, true). The conclusion of L4 thus corresponds to the conclusion of 

5. Another approach, more in keeping with FHM, would be to interpret / as a lower probability measure. 
On the other hand, interpreting I as an upper probability measure is more in keeping with the literature 

on upper probabilities. 

6. Note that, according to the syntax; of £'^'^, ipi, . . . , ipm must be propositional formulas. 
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UPS. Note that in the same way that UPl follows from UP2 and UPS, axiom LI (as 
well as LS) follows from L2 and L4. 

Instances of Taut include all formulas of the form / V -■/, where / is an arbitrary 
formula in . We could replace Taut by a simple collection of axioms that characterize 
propositional reasoning (see, for example, (Mendelson, 1964)), but we have chosen to focus 
on aspects of reasoning about upper probability. 

As in FHM, the axiom Ineq includes "all valid formulas about linear inequalities." An 
inequality formula is a formula of the form aixi + • • • + a„x„ > c, over variables xi, . . . , x„. 
An inequality formula is said to valid if it is true under every possible assignment of real 
numbers to variables. To get an instance of Ineq, we replace each variable Xi that occurs 
in a valid inequality formula by a primitive likelihood term of the form l{(pi) (naturally each 
occurence of the variable Xi must be replaced by the same primitive likelihood term l{ipi)). 
As with Taut, we can replace Ineq by a sound and complete axiomatization for Boolean 
combinations of linear inequalities. One such axiomatization is given in FHM. 

4. Soundness and Completeness 

A formula / is provable in an axiom system AX if / can be proven using the axioms and 
rules of inferences of AX. AX is sound with respect to a class A4 of structures if every 
formula provable in AX is valid in M. (i.e., valid in every structure in Ai); AX is complete 
with respect to M if every formula valid in Ai is provable in AX. 

Our goal is to prove that AX"^ is a sound and complete axiomatization for reasoning 
about upper probability (i.e., with respect to upper probability structures). The soundness 
of AX"^' is immediate from our earlier disscussion. Completeness is, as usual, harder. Un- 
fortunately, the standard technique for proving completeness in modal logic, which involves 
considering maximal consistent sets and canonical structures (see, for example, (Popkorn, 
1994)) does not work. We briefly review the approach, just to point out the difficulties. 

The standard approach uses the following definitions. A formula a is consistent with 
an axiom system AX if -kt is not provable from AX. A finite set of formulas {ai, . . . , cr„} 
is consistent with AX if the formula fJi A • • • A (T„ is consistent with AX; an infinite set 
of formulas is consistent with AX if all its finite subsets are consistent with AX. F is 
a maximal AX-consistent set if F is consistent with AX and no strict superset of F is 
consistent with AX. If AX includes Taut and MP, then it is not hard to show, using 
only propositional reasoning, that every AX-consistent set of formulas can be extended to 
a maximal AX-consistent set. 

To show that AX is complete with respect to some class M of structures, we must show 
that every formula that is valid in A4 is provable in AX. To do this, it is sufficient to show 
that every AX-consistent formula is satisfiable in some structure in Ai. Typically, this is 
done by constructing what is called a canonical structure M'^ in Ai whose states are the 
maximal AX-consistent sets, and then showing that a formula a is satisfied in a world w 
in M'^ iff (T is one of the formulas in the canonical set associated with world w. 

Unfortunately, this approach cannot be used to prove completeness here. To see this, 
consider the set of formulas 

F' = {m < - , n = l,2,...}U{Z((^) >0}. 
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This set is clearly AX"^'-consistent according to our definition, since every finite subset 
is satisfiable in an upper probability structure and AX^'P is sound with respect to upper 
probability structures. It thus can be extended to a maximal AX"^-consistent set F. 
However, the set F' of formulas is not satisfiable: it is not possible to assign l{(p) a value 
that will satisfy all the formulas at the same time. Hence, F is not satisfiable. Thus, the 
canonical model approach, at least applied naively, simply will not work. 

We take a different approach here, similar to the one taken in FHM. We do not try to 
construct a single canonical model. Of course, we still must show that if a formula / is 
AX"^-consistent then it is satisfiable in an upper probability structure. We do this by an 
explicit construction, depending on /. We proceed as follows. 

By a simple argument, we can easily reduce the problem to the case where / is a 
conjunction of basic likelihood formulas and negations of basic likelihood formulas. Let 
Pi,... ,Pn be the primitive propositions that appear in /. Observe that there are 2^ 
inequivalent propositional formulas over pi, . . . ,Pn- The argument goes as follows. Let an 
atom over pi, . . . ,pN be a formula of the form gi A . . . A qn, where qi is either pi or -ipj. 
There are clearly 2-^ atoms over pi, . . . ,pn. Moreover, it is easy to see that any formula 
over pi, . ■ . ,pn can be written in a unique way as a disjunction of atoms. There are 2 
such disjunctions, so the claim follows. 

Continuing with the construction of a structure satisfying /, let pi, . . . ,^22^ be some 
canonical listing of the inequivalent formulas over pi, . . . ,pn. Without loss of general- 
ity, we assume that pi is equivalent to true, and p^2N is equivalent to false. Since ev- 
ery propositional formula over pi, ■ ■ ■ ,Pn is provably equivalent to some p, it follows 
that / is provably equivalent to a formula /' where each conjunct of /' is of the form 
QiKpi) + • • • + 6*22^^(^22^) — f^- Note that the negation of such a formula has the form 

Oil{pi) H h ^22^^('^22^) < equivalently, (-^i)/(pi) H h {-0^2n)1{p22n) > -P. 

Thus, the formula / gives rise in a natural way to a system of inequalities of the form: 

Oi,iKpi)-\ 1- 22^ ^^22^) ^ "1 

Or,ll'{pl)-\ ^ 0_^,^2nI{p^2n) > Olr 

o[,ii{pi) + --- + e[^^^^i{p^2M) > Pi 

We can express (1) as a conjunction of inequality formulas, by replacing each occurrence 
of l{pi) in (1) by .Xj. Call this inequality formula /. 

If / is satisfiable in some upper probability structure M, then we can take Xi to be the 
upper probability of pi in M; this gives a solution of /. However, / may have a solution 
without / being satisfiable. For example, if / is the formula = 1/2 A l{^p) = 0, then 
/ has an obvious solution; /, however, is not satisfiable in an upper probability structure, 
because the upper probability of the set corresponding to p and the upper probability of the 
set corresponding to -^p must sum to at least 1 in all upper probability structures. Thus, 
we must add further constraints to the solution to force it to act like an upper probability. 

UP1-UP3 or, equivalently, the axioms L1-L4, describe exactly what additional con- 
straints are needed. The constraint corresponding to LI (or UPl) is just xi = 0, since 
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we have assumed pi is the formula false. Similarly, the constraint corresponding to L2 is 
x^2'^ — 1- The constraint corresponding to L3 is Xi > 0, for i = 1, . . . , 22 . What about 
L4? This seems to require an infinite collection of constraints, just as UPS doesJ 

This is where UPF3 comes into play. It turns out that, if / is satisfiable at all, it 
is satisfiable in a structure with at most 2^ worlds, one for each atom over pi,... ,pn- 
Thus, we need to add only instances of L4 where k, m, n < and ipi, . . . , ipm, ^re all 
among pi, . . . , P22^ • Although this is a large number of formulas (in fact, we do not know 
exactly how large, since it depends on B2N, which we have not computed), it suffices for our 
purposes that it is a finite number. For each of these instances of L4, there is an inequality 
of the form aixi + • • • + a^2NX^2N > k. Let /, the inequality formula corresponding to /, 
be the conjimction consisting of /, together with all the inequalities corresponding to the 
relevant instances of L4, and the equations and inequalities xi = 0, x^2^ = 1, and > 
for i = 1, . . . , 2 , corresponding to axioms L1-L3. 

Proposition 4.1: The formula f is satisfiable in an upper probability structure iff the 
inequality formula f has a solution. Moreover, if f has a solution, then f is satisfiable in 
an upper probability structure with at most 2^^^ worlds. 

Theorem 4.2: The axiom system AX^p is sound and complete for upper probability struc- 
tures. 

Proof: For soundness, it is easy to see that every axiom is valid for upper probability 
structures, including L4, which represents UP3. 

For completeness, we proceed as in the discussion above. Assume that formula / is not 
satisfiable in an upper probability structure; we must show that / is AX^^'-inconsistent. 
We first reduce / to a canonical form. Let (71 V • • • V Qr be a disjunctive normal form 
expression for / (where each is a conjunction of basic likelihood formulas and their 
negations). Using propositional reasoning, we can show that / is provably equivalent to this 
disjunction. Since / is unsatisfiable, each gi must also be unsatisfiable. Thus, it is sufficient 
to show that any unsatisfiable conjunction of basic likelihood formulas and their negations is 
inconsistent. Assume that / is such a conjunction. Using propositional reasoning and axiom 
L5, / is equivalent to a likelihood formula /' that refers to 2^ propositional formulas, say 
Pi) • • • )P22^- Since / is unsatisfiable, so is /'. By Proposition 4.1, the inequality formula 
/' corresponding to /' has no solution. Thus, by Ineq, the formula -1/" that results by 
replacing each instance of Xi in /' by l{pi) is AX"^-provablc. All the conjuncts of /" that 
are instances of axioms L1-L4 are AX"^ -provable. It follows that -■/' is AX"^' -provable, 
and hence so is ->/. I 

5. Decision Procedure 

Having settled the issue of the soundness and completeness of the axiom system AX****, 
we turn to the problem of the complexity of deciding satisfiability. Recall the problem of 

7. Although we are dealing with only finitely many formulas here, pi, ■ ■ ■ , Pja" 1 recall that the formulas 
(fi, . . . , (fm in L4 need not be distinct, so there are potentially infinitely many instances of L4 to deal 
with. 
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satisfiability: given a likelihood formula /, we want to determine if there exists an upper 
probability structure M such that M |= /. As we now show, the satisfiability problem is 
NP-complete, and thus no harder than satisfiability for propositional logic. 

For the decision problem to make sense, we need to restrict our language slightly. If 
we allow real numbers as coefficients in likelihood formulas, we have to carefully discuss 
the issue of representation of such numbers. To avoid these complications, we restrict our 
language (in this section) to allow only integer coefficients. Note that we can still express 
rational coefficients by the standard trick of "clearing the denominator" . For example, we 
can express | > 1 by 2l{ip) > 3 and l{ip) > | by 3Z((^) > 2. Recall that we defined 
I/I to be the length of /, that is, the number of symbols required to write /, where each 
coefficient is counted as one symbol. Define ||/|| to be the length of the longest coefficient 
appearing in /, when written in binary. The size of a rational number |, denoted |||||, 
where a and h are relatively prime, is defined to be ||a|| + ||6||. 

A preliminary result required for the analysis of the decision procedure shows that if a 
formula is satisfied in some upper probability structure, then it is satisfied in a structure 
vr), which is "small" in terms of the number of states in J7, the cardinality of the 
set V of probability measures, and the size of the coefficients in /. 

Theorem 5.1: Suppose f is a likelihood formula that is satisfied in some upper probability 
structure. Then f is satisfied in a structure S, "P, tt), where \^\ < S = 2^ (every 

subset of $7 is measurable), \V\ < \f\, f^{w) is a rational number such that \\n{w)\\ is 
+ l/P ^og(|/|)) for every world w & Q and € 'P, and n{w){p) = false for every 
world w E: Q and every primitive proposition p not appearing in f. 

Theorem 5.2: The problem of deciding whether a likelihood formula is satis fiable in an 
upper probability structure is NP-complete. 

Proof: For the lower bound, it is clear that a given propositional formula (p is satisfiable iff 
the likelihood formula l{Lp) > is satisfiable, therefore the satisfiability problem is NP-hard. 
For the upper bound, given a likelihood formula /, we guess a "small" satisfying structure 
M = (O,^,^, vr) for / of the form guaranteed to exist by Theorem 5.1. We can describe 
such a model M in size polynomial in |/| and ||/||. (The fact that tt{w){p) = false for 
every world w E ^ and every primitive proposition p not appearing in / means that we 
must describe tt only for propositions that appear in /.) We verify that M ^ / as follows. 
Let l{ip) be an arbitrary likelihood term in /. We compute IV-'Ja/ by checking the truth 
assignment of each s G and seeing whether this truth assignment makes ^ true. We then 
replace each occurence of l{il^) in / by max^g-p{^^g|^j^ A*(*)} and verify that the resulting 
expression is true. I 

6. Conclusion 

We have considered a logic with the same syntax as the logic for reasoning about probabil- 
ity, inner measures, and belief presented in FHM, with uncertainty interpreted as the upper 
probability of a set of probability measures. Under this interpretation, we have provided 
a sound and complete axiomatization for the logic. We further showed that the satisfiabil- 
ity problem is NP-complete (as it is for reasoning about probability, inner measures, and 
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beliefs), despite liaving to deal with probability structures with possibility infinitely many 
states and infinite sets of probability measures. The key step in the axiomatization involves 
finding a characterization of upper probability measures that can be captured in the logic. 
The key step in the complexity result involves showing that if a formula is satisfiable at all, 
it is satisfiable in a "small" structure, where the size of the state space, as well as the size 
of the set of probability measures and the size of all probabilities involved, are polynomial 
in the length of the formula. 

Given the similarity in spirit of the results for the various interpretations of the uncer- 
tainty operator (as a probability, inner measure, belief function, and upper probability), 
including the fact that the complexity of the decision problem is NP-complete in all cases, 
we conjecture that there is some underlying result from which all these results should follow. 
It would be interesting to make that precise. 

In FHM, conditional probabilities as well as probabilities are investigated. We have not, 
in this paper, discussed conditional upper probabilities. The main reason for this is that, 
unlike probability, we cannot characterize conditional upper probabilities in terms of (un- 
conditional) upper probabilities. Thus, our results really tell us nothing about conditional 
upper probabilities. It might be of interest to consider a logic that allows conditional up- 
per probabilities as primitive likelihood terms (that is, allows likelihood terms of the form 
l{ip\^)). While there is no intrinsic difficult giving semantics to such a language, it is far 
from clear what an appropriate axiomatization would be, or the effect of this extension on 
complexity. 

Finally, it is worth noting that the semantic framework developed here and in FHM 
is in fact rich enough to talk about gambles (that is, real-valued functions over the set 
of states) and the expectation of such gambles. Expectation functions can be defined for 
the different measures of uncertainty, including upper probabilities, and it is not difficult to 
extend the FHM logic in order to reason about expectation. One advantage of working with 
expectation functions is that they are typically easier to characterize than the corresponding 
measures; for instance, the characterization of expected upper probabilities is much simpler 
than that of upper probabilities (Huber, 1981; Walley, 1981, 1991). However, getting a 
complete axiomatization is quite nontrivial. We refer the reader to (Halpern & Pucella, 
2002) for more details on this subject. We remark that Wilson and Moral (1994) take as 
their starting point Walley's notion of lower and upper previsions. They consider when 
acceptance of one set of gambles implies acceptance of another gamble. Since acceptance 
involves expectation, it cannot be expressed in the logic considered in this paper; however, 
it can be expressed easiliy in the logic of (Halpern & Pucella, 2002). 
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Appendix A. Proofs 

Proposition 2.1: Property (6) implies properties (l)-(5). 

Proof: We introduce the following auxiliary properties to help derive the implications: 

(7) V*{A)+'P*{B)<VM^B) + V*{Af\B). 

(8) VM)+'P*{B)<VM^B)+V*{A\JB). 

(9) VM U 5) + n 5) < VM) + V*{B). 
(10) If A n B = 0, then 

V^{A)+r*iB)<r,{AuB)<V*{A)+r*{B)<V*{AUB)<V*{A)+r*iB). 

Using these properties, we show the following chain of implications: 

(10) =^ (9) =^ (3) 
(6) =^ (10) (10) =^ (7) =^ (4) (4), (5) ^ (1),(2). 

(10) =^ (8) =^ (5) 

The implication (4), (5) =^ (1), (2) follows easily by mutual induction on n. The 
base case is the following instances of properties (4) and (5): V^:{AU B) > V^{A) + V^{B) — 
V*{Ar\B) im<^V*{AV^B) < V* {A) + V*{B)-V*{Ar\B). The details are left to the reader. 

We now prove the remaining implications. 

(9) =^> (3): Since (9) is already one of the inequalities in (3), it remains to show that 
it implies the other inequality in (3), that is, vXa)+V*{B) < 'P*{A[JB) + 'P*iAr\B). 



p*{AuB) + r*iAnB) = i-r4AuB) + i-r4AnB) 

= l-V^(AnB) + l-V4AuB) 

= 2-{r^(AnB) + rM^B)) 

= 2~{n(BnA) + V4BuA)) 

> 2-ir4B)+V*(A)) 

= 1-V*(B) + 1-V*(A) 

= V*{B) + r*{A). 
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(7) =^ (4): Since (7) is already one of the inequalities in (4), it remains to show that 
it implies the other inequality in (4), that is, V*{AuB)+V*{AnB) < V* {A) +V* (B) . 

V*{A)+V*{B) = l-VM) + '^-'P*(B) 

= 2-{V4A)+r,(B)) 

> 2-{P^(A\JB)+P*(AnB)) 
= l-r*(AuB) + l-V*(AnB) 
= l-V,(AS]B) + l^V*(AljB) 
= V*{AnB)+V*iAuB). 

(8) =^ (5) : Since (8) is already one of the inequalities in (5) , it remains to show that 
it implies the other inequality in (5), that is, T'^{Ar\B)+r*iA\JB) < V* (A) +V* (B) . 

V*{A) + V*{B) = 1 ~ VM) + 'i- - ^*(B) 

= 2~{VM) + V,{B)) 

> 2-{V^{A^B)+V*{AiJB)) 
= 1-VM^B) + 1-V*(AUB) 
= l-V^(MjB) + l-V*(An^) 
= V*{A\JB)+VM^B). 

For the next implications, given A, B,lei Z = Ar\ B. 
(10) =^ (9): 

V*{A^B) = V*{iA-Z)UB) 

< V*{A- Z) + V*{B) [since (^ - Z) n 5 = 0] 

< V*{{A- Z)\JZ)-V*{Z) + V*{B) 

= v4A) + v*{B)-r4AnB). 



(10) =^ (7): 



(10) =^ (8): 



V^AUB) = V^{{A-Z)yjB) 

> VM- Z) + V^{B) 

> V4{A- Z)U Z) -V*{Z) + V^{B) 
= r4A)+V*iB)-V*{AnB). 



V*{A\JB) = r*{{A- Z)UB) 

> V*{A- Z) + V^{B) 

> P4iA-z)uz)-r^{z) + v4B) 

= V*iA)+r4B)-V4AnB). 
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(6) =^ (10)- Again, since (6) already comprises two of the inequalities in (10), it 
remains to show that it implies the other two, that is, ii A n B = 0, then 

V^A) + V^B) < V*iA UB)< V*{A) + V*{B). 

First, we show that V^A) + <V^{A[JB). Using (6), we know that 

V*(AnB)+V*{A) <V*{(AnB)uA) =V*(B). 

In other words, V*(A r\B)< V*(B) + V*{A). Prom this, we derive that 

V4AUB) = 1-V*(A[JB) 

= i-r*(AnB) 
> i-{r*(B)-r*{A)) 

= l-V*(B) + r*{A) 
= V4B) + V,{A). 

Second, we show that V^{A U B) < V*{A) + V^{B). Using (6), we know that 

V*(AnB) + V*{A) > V*{(AnB)[jA) = V*(B). 

(The last equality follows from the fact that (A nB) U A = B when ACiB = In 
other words, V*(A(lB) > V*(B) - V*{A). From this, we derive that 

r^{AUB) = l-r*{A\JB) 

= l-V*(AnB) 

< 1 - (V* (B) - V* (A)) 

= 1 - V* (B) + V* (A) 

= V4B) + V*iA). I 

Proposition 2.2: For < e < |, the function satisfies property (6), hut is not an 
upper probability measure. That is, we cannot find a set V' of probability measures such 
that Ve = {Vy. 

Proof: We are given < e < |. It is easy to check mechanically that satisfies (6). 

We now show that there is no set V' such that Ve = (V')* . By way of contradiction, 
assume there is such a V. By the properties of sup, this means that there is a n £ V such 
that iJ,{{a, 6, c}) > |, since fe({a, 6, c}) = | + e > |. Consider this /x in detail. Since n EV, 
we must have for all X G S, X / {a,b,c}, that n{X) < {T"y{X) = r*{X). In particular, 
/x({a, 6}),/x({6, c}),/x({a, c}) < \. Therefore, 

M{a,6})+M({ft,c})+M{a,c}) <| (2) 
However, from standard properties of probability, it follows that 

H{{a, b}) + /i({6, c}) + //({a, c}) = 2/x({a, 6, c}) > 2 x ^ = ^, 
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which contradicts (2). Therefore, ^, and therefore T" cannot exist, and is not an upper 
probabihty measure. I 

Theorem 2.4: There exists constants Bq,Bi,... such that if T, is an algebra of subsets 
of Q and v is a function t; : E ^ M, then there exists a set V of probability measures such 
that V = V* if and only if v satisfies the following properties: 

UPFl. v{$) = 0, 
UPF2. v{n) = 1, 

UPF3. for all integers m,n,k < B^q^ and all sets Ai, . . . , Am, if {{Ai, . . . , Am}} 
is an (n, k)-cover of {A, ^l), then k + nv{A) < YliLi ^(^i)- 

Proof: In view of Theorem 2.3, we need only show that there exist constant Bo,Bi,. . . 
such that a function v satisfies UPS iff it satisfies UPF3. Clearly, UPS always implies 
UPF3, so it is sufficient to show that there exists Bo,Bi,... such that UPFS implies 
UPS. 

We need some terminology before proceeding. An exact (n, k) -cover of {A, Q) is a cover 
C of A with the property that every element of A appears in exactly n + k sets in C, and 
every element of Q — A appears in exactly k sets in C. Thus, while an (n, A:)-cover of {A, Q) 
can have many extra sets, as long as the sets cover A at least n + k times and k times, 
an exact cover has only the necessary sets, with the right total number of elements. An 
exact (n, A;)-cover C of {A, is decomposable if there exists an exact (ni, A;i)-cover Ci and 
an exact (n2, A;2)-cover C2 of {A,Q) such that Ci and C2 form a nontrivial partition of C, 
with n = ni + 712 and k = ki + k2- Intuitively, an exact cover C is decomposable if it 
can be split into two exact covers. It follows easily by induction that for any exact {n, k)- 
cover, there exists a (not necessarily unique) finite set of nondecomposable exact covers 
Ci, . . . , Cm, with Ci an exact (n^, fcj)-cover, such that the Cj's a nontrivial partition of C 
with n = X^^i Ui and k = "Y^^v (If C is itself nondecomposable, we can take m = 1 and 
Ci = C.) One can easily verify that if C is an exact (n, /c)-cover of [A, Q) and C" C C is 
an exact (n', A;')-cover of {A, with n' -\-k' <n-\-k, then C is decomposable. 

The following lemma highlights the most important property of exact covers from our 
perspective. It says that for any set ^4 G E, there cannot be a "large" nondecomposable 
exact cover of {A,Q). 

Lemma A.l: There exists a sequence B[, B2, B'^, . . . such that for all A C. every exact 
{n, k)-cover of {A, Q) with n > B'^^ or k > B'^^^ is decomposable. 

Proof: It is clearly sufficient to show that for any finite we can find a i?|f^| with the 
required properties. Fix a fi. Given A Q Q, we first show that there exists Nj^ such that 
if 77. > A^^ or > Na, every exact (n, fe)-cover of {A, Q) is decomposable. Suppose for the 
sake of contradiction that this is not the case. This means that we can find an infinite 
sequence Ci, C2, . . . such that Cj is a nondecomposable exact (nj, A;i)-cover of {A, O), with 
either ni < 77-2 < . . . or A:i < A:2 < . . . . 

To derive a contradiction, we use the following lemma, known as Dickson's Lemma 
(Dickson, 1913). 
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Lemma A. 2: Every infinite sequence of d- dimensional vectors over the natural 

numbers contains a monotonically nondecreasing subsequence in the pointwise 
ordering (where x < y in the pointwise ordering iff Xi < yi for all i). 

Proof: It is straightforward to prove by induction on k that if A: < d, then 
every infinite sequence of vectors x^,x'^,. . . contains a subsequence x^^,x''^, . . . 
such that x^.^ , x*^ , . . . is a nondecreasing sequence of natural numbers for all 
j < k. The base case is immediate from the observation that every infinite 
sequence of natural numbers contains a nondecreasing subsequence. For the 
inductive step, observe that if x^^ , x*^ , . . . is a subsequence such that x*> ,x^?,... 
is a nondecreasing sequence of natural numbers for all j < k, then the sequence 
^fc+i; • • • of natural numbers must have a nondecreasing subsequence. This 
determines a subsequence of the original sequence with the appropriate property 
for ah j <k + l.M 

Let 51,... ,52in| be an arbitrary ordering of the 21^' subsets of Q. We can associate 
with any cover C a 2l^l -dimensional vector x*-" = (xf , . . . ,x^q|), where xp is the number 
of times the subset Si of O appears in the multiset C. The key property of this association 
is that if C and C are multisets, then C" C C iff x*-^ < x^ in the pointwise ordering. 

Consider the sequence of vectors x'^'^ , x'^^ _ _ _ associated with the sequence Ci , C2 , . . . 
of nondccomposable exact covers of {A,0,). By Lemma A. 2, there is a nondecreasing sub- 
sequence of vectors, x*-^'! < x'^'a < • • • . But this means that Cj^ C C • • • . Since 
ni < n2 < ■ ■ ■ or ki < k2 < ■ ■ ■ , every cover in the chain must be distinct. But any pair 
of exact covers in the chain is sTich that Cj C Cj+i, meaning (7j_|-i is decomposable, contra- 
dicting our assumption. Therefore, there must exist an A^^ such that any exact (n, fe)-cover 
of A with n > Na or fc > Na is decomposable. 

Now define B'^^ = max{A?^A : ^ ^ {!,... , It is easy to see that this choice 

works. I 

To get the constants Bi,B2, ... , let Bn = 2NB'j^, for N = 1,2, ... , where B'j^ is as 
in Lemma A.l. We now show that UPF3 implies UPS with this choice of Bi, B2, . . . . 
Assume that UPF3 holds. Fix fi. Suppose that C = {{Ai,... ,A„i}} is an (n, A;)-cover 
of {A,Q,) with |C| = m. We want to show that k + nv{A) < YliLi ^^(^i)- We proceed as 
follows. 

The first step is to show that, without loss of generality, C is an exact (n, A;)-cover of 
(A,i}). Let Bi consist of those states s £ Ai such that cither s £ A and s appears in 
more than n + k sets in yli, . . . , or s G O — ^ and s appears in more than k sets in 
Ai,... , Ai_i. Let A'j^ = Ai - Bi. Let C = {{A[, ... , A'^}}. It is easy to check that C is 
an exact (n, /c)-cover of {A, Jl). For if s £ A, then s appears in exactly n + k sets in C' (it 
appears in A'^ iff Aj is among the first n + k sets in C in which s appeared) and, similarly, 
if s G ri — ^, then s appears in exactly k sets in C' . Clearly if UPS holds for C , then it 
holds for C, since v{A[) < v{Ai) for i = 1, . . . ,m. Thus, we can assume without loss of 
generality that C is an exact (n, A;)-cover of A. 

We can also assume without loss of generality that no set in C is empty (otherwise, 
we can simply remove the empty sets in C; the resulting set is still an (n, fc)-cover of 
{A,Q,)). There are now two cases to consider. If max(m, n, /c) < -B|q|, the desired result 
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follows from UPF3. If not, consider a decomposition of C into multisets Ci,... ,Cp, 
where Ch is an exact {nh,kh)-cover of {A,i}) and is not further decomposable. We claim 
that max{\Ch\,nh,kh) < for /i = 1,... ,p. If n/j > B^^ or /c/j > B^q^, then it is 
immediate from Lemma A.l that Ch can be further decomposed, contradicting the fact 
that Ch is not decomposable. And if \Ch\ > then observe that J2xeCh — 

Since \Ch\ > = 2|f^|-B|Q|, there must be some s € which appears in at least 2B'^^^ 
sets in C/,. Since C), is an exact (rih, fc/J-cover, it follows that either n/j > B'^^^ or > B'\ci\- 
But then, by Lemma A.l, Ch is decomposable, again a contradiction. 
Now we can apply UPF3 to each of Ci , . . . , to get 

^ viX) - nhv{A) > kh. 
xeCh 

Since the C/j's form a decomposition of C, we have 

j^i E viX)-nhv{X)\ yj^kh 
h=i \xeCh / h=i 

h=l / h=l h=l 

m p p 

v{Ai) - ( nh)v{A) >Y,kh 

i=l h=l h=l 

By decomposition, n = Yl\=i and k = Yl^=i ^h, ^^nd therefore YliLi '^(Ai) — nv{A) > k, 
showing that UPS holds, as desired. I 

Proposition 4.1: The formula f is satisfiable in an upper probability structure iff the 
inequality formula f has a solution. Moreover, if f has a solution, then f is satisfiable in 
an upper probability structure with at most 21-^1 worlds. 

Proof: Assume first that / is satisfiable. Thus there is some upper probability structure 
M = (Q,T,,V,tt) such that M \= f. As in Section A, let pi, . . . ,pn he the primitive propo- 
sitions that appear in /, and let pi, . . . , p^i^ be some canonical listing of the inequivalent 

formulas over pi, . . . , piy . Without loss of generality, we assume that pi is equivalent to 
true, and p,^2'^ is equivalent to false. Define the vector x* by letting x* = 'P*([pi]A^), 

for 1 < i < 2 . Since M |= /, it is immediate that x* is a solution to the inequality 

— 02'^ 
formula /. Moreover, since pi = false and p = true, it follows that x^ = (since 

r*{lfalse}M) = V*{^) = 0) and x*^^ = 1 (since r*{[true\M) = V*{^) = 1). Finally, 

consider a conjunct of / corresponding to an instance of L4; suppose it has the form 

Xi^ + ■ ■ ■ Xi^ — nxi^^^ > k. Since this conjunct appears in /, it must be the case that 

(PWi ^ V,/c{i,...,m},|,7|=fe+n Ajc{i,...,m},iejPb) /\ \j\=k AjeJ Pij) ^ propositional tau- 
tology. Thus, it follows that |pi Jm, • • • , (pimiM is an (n, A:)-cover for ([pi^+ Jm, ItruejM)- 
It follows from UPS that 

V^IpM + ■■■ + VilPijM) - nV*{lpjM) > k. 
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Thus, X* is a solution to the inequality formulas corresponding to L4. Hence, x* is a solution 
to /. 

For the converse, assume that x* is a solution to /. We construct an upper probability 
structure M = {S,E,P,7r) such that M |= / as follows. Let pi,. . . ,Pn be the primitive 
propositions appearing in /. Let S = {6i, . . . , d2N} be the atoms over pi, . . ■ ,pn- Let E be 
the set of all subsets of S. As observed earlier, every propositional formula over pi, . . . ,Pn 
is equivalent to a unique disjunction of atoms. Thus, we can get a canonical collection 
pi , . . . , ^22^ of inequivalent formulas over pi, ■ ■ ■ ,Pn by identifying each formula pi with a 
different element of E, where pi corresponds to the empty set and p^2'^ corresponds to all 
of S. Define a set function v by taking v{{Si-^ , . . . ,di.}) = x* if pi is the disjunction of the 
atoms . . . , Si-. Let 7r{S){p) = true iS 6 ^ p. 

It is now sufficient to show that v is an upper probability (of a set V of probability 
measures), since then it is clear that {S, E, V,7r) \= f (since x* is a solution to /, the system 
of inequalities derived from formula /). To do this, by Theorem 2.4, it suffices to verify 
UPFl, UPF2, and UPF3, using in UPF3, since \S\ = 2^. 

UPFl: i;(0) =xl = 0. 
UPF2: viS) = xl^^ = 1. 

UPF3: Suppose that A and Ai,... ,A jyi arc in E and satisfy the premises of prop- 
erty UPF3, with k,m,n < B2N. Let Pi^, ■ ■ ■ ,Pim,Pi,n+i be the canoni- 
cal formulas corresponding to Ai,... ,Am,A, respectively. Clearly, A C 

UjC{l,...,m},\J\=k+nr\j€J^ij Pim+i =^ \/ JC{1,... ,m},\J\=k+n AjeJ Pij ^ 

propositional tautology and similarly Q C |Jjc{i m} \j\=kC\jeJ^ij ^ 
yjc{i,...,m},\J\=k/\jejPij ^ propositional tautology. Thus, EjLi a^i, - 
^ini+i > is one of the inequality formulas in /. Thus, it follows that 
'y'J^-^ — X*, > k, as desired. By our definition of v, we therefore have 
k + nv{A) < YT=i ^(A), and so UPF3 holds. I 



Theorem 5.1: Suppose f is a likelihood formula that is satisfied in some upper probability 
structure. Then f is satisfied in a structure (0,E,'P, tt), where \Q\ < |/|^, S = 2^ (every 
subset of is measurable), {Vl < \f\, p-iw) is a rational number such that ||;^(?i;)|| is 
+ l/Plog(|/|)) for every world w G Jl and pEV, and ■k{w){p) = false for every 
world w ^Q, and every primitive proposition p not appearing in f . 

Proof: The first step in the proof involves showing that if P is a set of probability measures 
defined on an algebra E of a finite space we can assume without loss of generality that 
for each set X € S, there is a probability measure px G such that px{^) = V*{X) 
(rather than V*{X) just being the sup of p{X) for p £ V). 

Lemma A. 3: LetV be a set of probability measures defined on an algebra S over a finite set 
il. Then there exists a set V' of probability measures such that, for each X S S, V*{X) = 
{V')*{X); moreover, there is a probability measure px G 'P' such that px{X) = V*{X). In 
addition, for any interpretation tt, if M = (O, E,?-*, tt) and M = (O, S,P',7r), then for all 
likelihood formulas f , M \= f iff M' \= f . 
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Proof: Since S is finite, to show that V' exists, it clearly suffices to show that, for each 
X G S, there is a probability measure jix such that ijlx{X) = V*{X) and, if T" = VU{fJ-x}, 
then r*{Y) = {V')*{Y) for all y G S. 

Given X, if there exists eV such that fi{X) = V*{X), then we are done. Otherwise, 
we construct a sequence fxi, fj,2, ■ ■ ■ of probability measures in V such that limj/ij(X) = 
V*{X) and, for all y G E, the sequence ^iiY) converges to some limit. Let Xi,... 
be an enumeration of the sets in S, with Xi = X. We inductively construct a sequence of 
measures lJ.mi,IJ'm2, ■ ■ ■ in P for m < n such that fimi{Xj) converges to a limit for i < k 
and limj_>oo /imj(^) = V*iX). For m = 1, we know there must be a sequence /xii,;Ui2, • • • 
of measures in V such that fiii{X) converges to 'P*{X). For the inductive step, if m < n, 
suppose we have constructed an appropriate sequence fJ^mi, lJ'm2, ■ ■ ■ ■ Consider the sequence 
of real numbers UmiiXm+i)- Using the Bolzano- Weierstrass theorem (Rudin, 1976) (which 
says that every sequence of real numbers has a convergent subsequence), this sequence has 
a convergent subsequence. Let ^(m+i)i) /^(m+i)27 • • • be the subsequence of jJ-mii IJ'm2, ■ ■ ■ 
which generates this convergent subsequence. This sequence of probability measures clearly 
has all the required properties. This completes the inductive step. 

Define fix{y) = limi_,oo /^ni(^)- It is easy to check that that fix is indeed a probability 
measure, that nx{X) = V*{X), and if V' = V U {/xx}, that P*{Y) = (P')*(^) for all 
y G S. This shows that an appropriate set V' exists. 

Now, given vr, let M = (fi, E, V, tt) and M' = (0, S, V', tt). A straightforward induction 
on the structure of / shows that M ^ / iff M' \= f. For the base case: 

{Q, S, V, vr) 1= ail{ipi) H h aJifn) > a 

^ aiV*{lipijM) + --- + anV*{lipn}M)>a 

^ ai(P')*(bllM') + • • • + aniV'ni^njM') > O 

<^ (fi, S, T", tt) \= ail{(pi) + ■■■ + aJifn) > a. 

The others cases are trivial. | 

Just as in FHM, to prove Theorem 5.1, we make use of the following lemma which 
can be derived from Cramer's rule (Shores, 1999) and simple estimates on the size of the 
determinant (see also (Chvatal, 1983) for a simpler variant): 

Lemma A. 4: // a system of r linear equalities and/or inequalities with integer coefficients 
each of length at most I has a nonnegative solution, then it has a nonnegative solution with at 
most r entries positive, and where the size of each member of the solution is 0{rl+r\og{r)). 

Continuing with the proof of Theorem 5.1, suppose that / is satisfiable in an upper 
probability structure. By Proposition 4.1, the system / of equality formulas has a solu- 
tion, so / is satisfied in a upper probability structure with a finite state space. Thus, by 
Lemma A. 3, / is satisfied in a structure M = (fl, S, V, tt) such that for all X G S, there 
exists /XX e "P such that //x(X) = V*{X). 

As in the completeness proof, we can write / in disjunctive normal form. Each disjunct 
gr is a conjunction of at most |/[ — 1 basic likelihood formulas and their negations. Since 
M \= f, there must be some disjunct g such that M \= g. Suppose that g is the conjunction 
of r basic likelihood formulas and s negations of basic likelihood formulas. Let pi, . . . ,pn 
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be the primitive formulas appearing in /. Let Si, . . . , be the atoms over pi, . . . ,pN. 
As in the proof of completeness, we derive a system of equalities and inequalities from g. 
It is a slightly more complicated system, however. Recall that each prepositional formula 
over pi, . . . ,pn is a disjunction of atoms. Let (fi, ■ ■ ■ , be the propositional formulas that 
appear in g. Notice that k < \ f\ (since there are some symbols in /, such as the coefficients, 
that are not in the propositional formulas). The system of equations and inequalities we 
construct involve variables Xij, where i = 1,... ,k and j = 1,... ,2^. Intuitively, Xij 
represents /j^.j^HS^m), where G P is such that /^[.^j^d^'ilM) = 'P*{lipijM)- Thus, 

the system includes A; < |/| equations of the following form, 

Xil-\ \-Xi2N = 1, 

for i = 1,... Since /^|(^i]ji^([¥'ilM) > KI^PiIm) for ah // G if Ei is the subset of 
{1, . . . , 2^} such that cpi = \J j^Ei ^j-> system includes k"^ — k inequalities of the form 

jeEi jeEi 

for each pair i, i' such that i 7^ i'. For each conjunct in g of the form 6il{ipi) + • • • + 
dnK^k) > a, there is a corresponding inequality where, roughly speaking, we replace l{(pi) 
by l^lipilMiyjM)-^ Since Hy^jj^ corresponds to Y,jeEi ^ij^ appropriate inequality is 

k 

1=1 jeEi 

Negations of such formulas correspond to a negated inequality formula; as before, this is 
equivalent to a formula of the form 

k 

i=i jeEi 

Notice that there are at most |/| inequalities corresponding to the conjuncts of g. Thus, 
altogether, there are at most k{k — 1) + 2|/| < |/p equations and inequalities in the 

system (since k < |/|). We know that the system has a nonnegative solution (taking 
Xj- to be /ti[,^jjv^([5-']M))- It follows from Lemma A. 4 that the system has a solution 
X* = {xli, . . . , x*^f^, . . . , x^.^, . . . , a;^2Jv) with t < |/p entries positive, and with each entry 
ofsizeO(|/|2||/|| + |/|2log(|/|)). 

We use this solution to construct a small structure satisfying the formula /. Let / = 
{i : x*- is positive, for some j}; suppose that / = {ii, . . . ,it'}, for some t' < t. Let 
M = (S, E, V, it) where S has t' states, say si, . . . ,st', and E consists of all subsets of S. Let 
7r(s/i) be the truth assignment corresponding to the formula that is, 7r(sft)(p) = true 
if and only if (5^^ =^ p (and where 7r(s/i)(p) = false if p does not appear in /). Define 
V = {fij : 1 < i < k}, where fijis^) = ^l^j. It is clear from the construction that M \= f. 
Since \V\ = k < \f\, \S\ = t' < t < |/p and /J^jish) = x^^j, where, by construction, the size 
ofxlj is Od/pll/ll + |/|2log(|/|)), the theorem follows. I 



8. For simplicity hero, wc arc implicitly assuming that each of the formulas ipi appears in each conjunct of 
g. This is without loss of generality, since if ifi does not appear, we can put it in, taking 6i = 0. 
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Appendix B. Proof of the Characterization of Upper ProbabiUties 

To make this paper self-contained, in this appendix we give a proof of Theorem 2.3. The 

proof we give is essentially that of Anger and Lembcke (1985). Walley (1991) gives an 
alternate proof along somewhat similar lines. Note that the functional g wc define in our 
proof corresponds to the construction in Walley's Natural Extension Theorem, which is 
needed in his version of this result. 

Theorem 2.3: Suppose that Q is a set, S is an algebra of subsets of and u : E — > M. 

Then there exists a set V of probability measures with v = V* if and only if v satisfies the 
following three properties: 

UPl. v{0) = 0, 
UP2. v{n) = 1, 

UP3. for all integers m, n, k and all subsets Ai, . . . , Am in S, if {{Ai, . . . , Ajn}} 
is an (n, k)-cover of {A, Q,), then k + nv{A) < YliLi ^i^i)- 

Proof: The "if" direction of the characterization is straightforward. Given V = {/Xijjg/ a 
set of probability measures, we show V* satisfies UP1-UP3. 

UPl: P*(0) = sup{/Xi(0)} = sup{0} = 
UP2: P*{n) = sup{fii{n)} = sup{l} = 1 

UPS: Given Ai,... ,Am and A such that A C Ujc{i,... ,m},| j|=fc+n PljeJ ^^'^ 
^ - Ujc{i,...,m},|J|=fcrijGj^ii' then for any i we have kmifl) + nHi{A) < 
EJLiW(^jj,'that is k + nfii{A) < ET=il'ii^j) ^ sup,{E,"Li/^i(^j)} < 
E^li supMAj)} = Er=i^*(^j)- But snpi{k+n,,iiA)} = k+nsupMA)} = 
k + nV*{A), sok + nV*{A) < 'P*{Aj), as required. 

As for the "only if" direction, we first prove a general lemma relating the problem to the 
Hahn-Banach Theorem. Some general definitions arc needed. Suppose that we are given a 
space W and an algebra of subsets of W. Let /C be the vector space generated by the 
indicator functions Ix defined by 



for X € J^. A sublinear functional on IC is a mapping c : /C — > M such that c{ah) = ac{h) 
for a > and c{hi + /12) < c(/ii) + c(/i2) for all hi,h2- A sublinear functional is increasing 
a h >0 implies c{h + h') > c{h') for all h' G IC. The following result is a formulation of the 
well-known Hahn-Banach Theorem (see, for example, (Conway, 1990)). 

Theorem (Hahn-Banach): Let IC be a vector space over M, and let g be a sublinear 
functional on IC. If M. is a linear subspace in IC and A : — >■ M is a linear functional such 
that A(x) < g{x) for all x in Ai, then there is a linear functional A' : /C — > R such that 
^'\m = ^ o.'f'd \'{x) < g{x) for all x in IC. 

Lemma B.l: Let g : F ^ [0,1] be such that g{W) = 1 and suppose that there is an 
increasing sublinear functional g on IC such that 
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1. g{lK) = g{K) for K G J^; 

2. g{h) <Oifh<0; 

3. 5(— 1) < —1 (where g{a) is identified with g{alw))- 
Then g is an upper probability measure. 

Proof: We show that g is an upper probabihty by exhibiting a set {nx '■ X G S} of 
probabiUty measures, with the property that /Lix(^) = gi^) and < g{X) for Y X. 

Each probabihty measure iJ,x is constructed through an apphcation of the Hahn-Banach 
Theorem. 

Given X ^ define tlic hnear functional A on tlic siibspace generated by Ix by 
\{alx) = o:g{lx)- We claim that X{h) < g{h) for all h in the subspace. Since the elements 
of the subspace have the form alx, there are two cases to consider: a > and a < 0. 
If a > 0, then X{alx) = 0!.g{lx) = g{oilx), since g is sublinear. Moreover, = ^(0) = 
9{-lx + Ix) < + 9{lx), so g{-lx) > -9{lx)- Thus, if a > 0, then 

X{-alx) = -ag{lx) < ag{-lx) = g{-alx)- 

Now, by the Hahn-Banach Theorem, we can extend A to a linear functional A' on all of 
JC such that X'{h) < g(h) for all h. We claim that (a) A'(ly) > for all F € /C and (b) 
A'(l) = 1. For (a), note that A'(-ly) < ^(-ly) < by assumption, so A'(ly) > 0. For 
(b), note that A'(l) < ^(1) = g{W) = 1 and that A'(l) = -A'(-l) > -^(-l) > 1 (since 
g{—l) < —1, by assumption). 

Define /J-xiY) = A'(ly). Since X'{lw) = 1, ^x(W^) = 1- If ^ and Y' are disjoint, it is 
immediate from the linearity of A that HxiY U Y') = //x(^) + -^y construction, 

fix{Y) < 5(ly) = 9{Y) for any Y ^ X, and nx{X) = X{lx) = g{lx) = 9{X). Bottom 
line: there is a probability measure fix dominated by g such that nxiX) = g{X). 

Take V = {fix '■ X € S}. Since for any X we have that fix{X) = g{X) and 
l^x{Y) < g{X) (if y / X), we have V*{X) = nx{X) = g{X). Therefore, g = V* . M 

The main result follows by showing how to construct, from a function v satisfying the 
properties of Theorem 2.3, a sublineax functional c on with the required properties. 

Suppose that ^ : E ^ R is a function satisfying UP1-UP3. As we show in the discussion 
after Theorem 2.3 in the text, UP1-UP3 show that the range of g is in fact [0, 1]. Since g 
satisfies UPS, if {{Ki, . . . , K^}} is an (n, /c)-cover of {K, Q), we have k + ng{K) < YliLi ^i- 
This is equivalent to saying that k + nix < Y^^i ^Ki- Hence, for all iiTi, . . . , such that 
k + nix < YliLi ^Ki, we have k + ng{K) < YliLi gi^i), or equivalently 

7 -| rri 

-- + -Y.9m>g{K). (3) 

i=l 

This observation motivates the following definition of the functional ^ : /C ^ M U 
{— oo, oo}: 

g{h) =inf I + -y^g{Ki) : m,n, k e N, m,n > 0, Ki, . . . , Km e J^, + - V > 

K i=i 1=1 J 

Our goal now is to show that g satisfies the conditions of Lemma B.l. 
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• It is almost immediate from the definitions that g is increasing: if /t > and -| + 

'n ^T=i ^K,>h + h', then -I + i E.=i Ik. > h' . 

• To see that g is subUnear, note that it is easy to see using the properties of inf that 
g{hi + /12) < gi^i) + g{h2)- To show that g{ah) = ag{h) for a > 0, first observe that 
the definition of g is equivalent to 

{m m ^ 

-P + Y,PigiKi):men,(3,pi€R+,Ki,... ,Km € J' - P + Pilx, > h\ . 
i=l i=l ) 

Consider first the case a > 0. Then 

{m m ^ 

i=l i=l } 

f m 3 I 1 

= mi\-P + Y,Pi9{Ki) : - - + - Al^, > [ 
I i=i a a .^^ J 

= aM\-^ + -y2Pig{Ki) : - ^ + -S^ p.lj,^ > h\ 
a a a a 

I, 1=1 1=1 J 

= ag{h). 

For a = 0, it is clear from the definition of g that ^(l©) < 5(0)- Prom (3) it follows 
that gm) > 5(0), and hence ~g{Q) = g^) = g{$) = 0. 

• It is immediate from the definition of g that g{lK) < 9{K) for K E the fact that 
gi^K) = g{K) now follows from (3). 

• It is immediate from the definition that ^(—1) < —1. 

• If /i < 0, then —h > 0; since g is increasing, g{h) < g{—h + h) = g{0), and since g is 
sublinear, ^(0) = 0. 

Since the conditions of Lemma B.l are satisfied, g is an upper probability measure. I 
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